Pass Amazon AWS-Solutions-Architect-Associate Actual Free Exam Q&As Updated Dump Jul 21, 2024
Latest AWS-Solutions-Architect-Associate Actual Free Exam Updated 686 Questions
AWS Solutions Architect – Associate certification is highly valued in the IT industry, as it demonstrates that an individual has the skills and knowledge to design and deploy highly scalable, fault-tolerant systems on AWS. AWS Certified Solutions Architect - Associate (SAA-C02) certification is recognized by companies worldwide and can lead to higher salaries and career advancement opportunities. It is a valuable asset for IT professionals who want to work with AWS and advance their careers in the cloud computing industry.
Earning the AWS Certified Solutions Architect - Associate certification can help solutions architects demonstrate their expertise and credibility in the AWS ecosystem. AWS Certified Solutions Architect - Associate (SAA-C02) certification can also help professionals advance their careers and achieve their professional goals, as it is recognized by top employers and organizations worldwide. Additionally, AWS Certified Solutions Architects are in high demand, and this certification can lead to higher salaries and better job opportunities.
Amazon AWS-Solutions-Associate Certification Exam is designed for individuals who want to become certified as an AWS Certified Solutions Architect - Associate (SAA-C02). AWS Certified Solutions Architect - Associate (SAA-C02) certification is intended for professionals who have experience in designing and deploying scalable, highly available, and fault-tolerant systems on the AWS platform. AWS Certified Solutions Architect - Associate (SAA-C02) certification exam evaluates the candidate's ability to design and deploy scalable, highly available, and fault-tolerant systems on AWS, as well as their knowledge of AWS services and best practices.
NEW QUESTION # 282
A company is developing a file-sharing application that will use an Amazon S3 bucket for storage The company wants to serve all the files through an Amazon CloudFront distribution. The company does not want the files to be accessible through direct navigation to the S3 URL What should a solutions architect do to meet these requirements?
- A. Create an IAM user Grant the user read permission to objects in the S3 bucket Assign the user to CloudFront
- B. Write an S3 bucket policy that assigns the CloudFront distribution ID as the Principal and assigns the target S3 bucket as the Amazon Resource Name (ARN)
- C. Create an origin access identity (OAI). Assign the OAI to the CloudFront distribution Configure the S3 bucket permissions so that only the OAI has read permission
- D. Write individual policies for each S3 bucket to grant read permission for only CloudFront access.
Answer: C
NEW QUESTION # 283
A company has an application that calls AWS Lambda functions. A recent code review found database credentials stored in the source code. The database credentials needs to be removed from the Lambda source code. The credentials must then be securely stored and rotated on a on-going basis to meet security policy requirements.
What should a solutions architect recommend meet these requirements?
- A. Store the password in AWS Secrets Manager . A associate the Lambda function with a role that can retrieve the password from secrets Manager given its secret ID.
- B. Move the database password to an environment variable associate the Lambda function Retrieve the password from the environment variable upon execution.
- C. Store the password in AWS Key Management Service (AWS KMS). Associate the Lambda function with a role that can retrieve the password from AWS KMS given its key ID.
- D. Store the password in AWS CloudHSM. Associate the Lambda function with a role that can review the password from CloudHSM given key ID.
Answer: A
NEW QUESTION # 284
You have deployed a web application targeting a global audience across multiple AWS Regions under the domain name.example.com. You decide to use Route53 Latency-Based Routing to serve web requests to users from the region closest to the user. To provide business continuity in the event of server downtime you configure weighted record sets associated with two web servers in separate Availability Zones per region. Dunning a DR test you notice that when you disable all web servers in one of the regions Route53 does not automatically direct all users to the other region. What could be happening? {Choose 2 answers)
- A. You did not setup an HTIP health check tor one or more of the weighted resource record sets associated with me disabled web servers.
- B. One of the two working web servers in the other region did not pass its HTIP health check.
- C. The value of the weight associated with the latency alias resource record set in the region with the disabled servers is higher than the weight for the other region.
- D. Latency resource record sets cannot be used in combination with weighted resource record sets.
- E. You did not set "Evaluate Target Health" to "Yes" on the latency alias resource record set associated with example com in the region where you disabled the servers.
Answer: A,E
Explanation:
How Health Checks Work in Complex Amazon Route 53 Configurations
Checking the health of resources in complex configurations works much the same way as in simple configurations. However, in complex configurations, you use a combination of alias resource record sets (including weighted alias, latency alias, and failover alias) and nonalias resource record sets to build a decision tree that gives you greater control over how Amazon Route 53 responds to requests.
For more information, see How Health Checks Work in Simple Amazon Route 53 Configurations.
For example, you might use latency alias resource record sets to select a region close to a user and use weighted resource record sets for two or more resources within each region to protect against the failure of a single endpoint or an Availability Zone. The following diagram shows this configuration.
Here's how Amazon EC2 and Amazon Route 53 are configured:
You have Amazon EC2 instances in two regions, us-east-1 and ap-southeast-2. You want Amazon Route
5 3 to respond to queries by using the resource record sets in the region that provides the lowest latency for your customers, so you create a latency alias resource record set for each region.
(You create the latency alias resource record sets after you create resource record sets for the individual Amazon EC2 instances.) Within each region, you have two Amazon EC2 instances. You create a weighted resource record set for each instance. The name and the type are the same for both of the weighted resource record sets in each region.
When you have multiple resources in a region, you can create weighted or failover resource record sets for your resources. You can also create even more complex configurations by creating weighted alias or failover alias resource record sets that, in turn, refer to multiple resources.
Each weighted resource record set has an associated health check. The IP address for each health check matches the I P address for the corresponding resource record set. This isn't required, but it's the most common configuration.
For both latency alias resource record sets, you set the value of Evaluate Target Health to Yes.
You use the Evaluate Target Health setting for each latency alias resource record set to make Amazon Route 53 evaluate the health of the alias targets-the weighted resource record sets-and respond accordingly.
The preceding diagram illustrates the following sequence of events:
Amazon Route 53 receives a query for example.com. Based on the latency for the user making the request, Amazon Route 53 selects the latency alias resource record set for the us-east-1 region.
Amazon Route 53 selects a weighted resource record set based on weight. Evaluate Target Health is Yes for the latency alias resource record set, so Amazon Route 53 checks the health of the selected weighted resource record set.
The health check failed, so Amazon Route 53 chooses another weighted resource record set based on weight and checks its health. That resource record set also is unhealthy.
Amazon Route 53 backs out of that branch of the tree, looks for the latency alias resource record set with the next-best latency, and chooses the resource record set for ap-southeast-2.
Amazon Route 53 again selects a resource record set based on weight, and then checks the health of the selected resource record set . The health check passed, so Amazon Route 53 returns the applicable value in response to the query.
What Happens When You Associate a Health Check with an Alias Resource Record Set?
You can associate a health check with an alias resource record set instead of or in addition to setting the value of Evaluate Target Health to Yes. However, it's generally more useful if Amazon Route 53 responds to queries based on the health of the underlying resources- the HTTP servers, database servers, and other resources that your alias resource record sets refer to. For example, suppose the following configuration:
You assign a health check to a latency alias resource record set for which the alias target is a group of weighted resource record sets.
You set the value of Evaluate Target Health to Yes for the latency alias resource record set.
In this configuration, both of the following must be true before Amazon Route 53 will return the applicable value for a weighted resource record set:
The health check associated with the latency alias resource record set must pass.
At least one weighted resource record set must be considered healthy, either because it's associated with a health check that passes or because it's not associated with a health check. In the latter case, Amazon Route 53 always considers the weighted resource record set healthy.
If the health check for the latency alias resource record set fails, Amazon Route 53 stops responding to queries using any of the weighted resource record sets in the alias target, even if they're all healthy.
Amazon Route 53 doesn't know the status of the weighted resource record sets because it never looks past the failed health check on the alias resource record set.
What Happens When You Omit Health Checks?
In a complex configuration, it's important to associate health checks with all of the non-alias resource record sets. Let's return to the preceding example, but assume that a health check is missing on one of the weighted resource record sets in the us-east-1 region:
Here's what happens when you omit a health check on a non-alias resource record set in this configuration:
Amazon Route 53 receives a query for example.com. Based on the latency for the user making the request, Amazon Route 53 selects the latency alias resource record set for the us-east-1 region.
Amazon Route 53 looks up the alias target for the latency alias resource record set, and checks the status of the corresponding health checks. The health check for one weighted resource record set failed, so that resource record set is omitted from consideration.
The other weighted resource record set in the alias target for the us-east-1 region has no health check.
The corresponding resource might or might not be healthy, but without a health check, Amazon Route 53 has no way to know. Amazon Route 53 assumes that the resource is healthy and returns the applicable value in response to the query.
What Happens When You Set Evaluate Target Health to No?
In general, you also want to set Evaluate Target Health to Yes for all of the alias resource record sets.
In the following example, all of the weighted resource record sets have associated health checks, but Evaluate Target Health is set to No for the latency alias resource record set for the us-east-1 region:
Here's what happens when you set Evaluate Target Health to No for an alias resource record set in this configuration:
Amazon Route 53 receives a query for example.com. Based on the latency for the user making the request, Amazon Route 53 selects the latency alias resource record set for the us-east-1 region.
Amazon Route 53 determines what the alias target is for the latency alias resource record set, and checks the corresponding health checks. They're both failing.
Because the value of Evaluate Target Health is No for the latency alias resource record set for the us-east-1 region, Amazon Route 53 must choose one resource record set in this branch instead of backing out of the branch and looking for a healthy resource record set in the ap-southeast-2 region.
NEW QUESTION # 285
A company's new web application running on Amazon EC2 across multiple Availability Zones (AZs) will be heavily accessed during regular business hours After business hours, usage will be minimal. What fleet-scaling approach should be used to size the EC2 fleet to handle the traffic demands?
- A. Manual scaling across all AZs
- B. Provisioning for peak traffic
- C. Programmatic termination of all instances in one AZ during off-peak hours
- D. Scheduled scaling
Answer: D
NEW QUESTION # 286
A company wants to move a multi-tiered application from on premises to the AWS Cloud to improve the application's performance. The application consists of application tiers that communicate with each other by way of RESTful services. Transactions are dropped when one tier becomes overloaded. A solutions architect must design a solution that resolves these issues and modernizes the application.
Which solution meets these requirements and is the MOST operationally efficient?
- A. Use Amazon CloudWatch metrics to analyze the application performance history to determine the server's peak utilization during the performance failures. Increase the size of the application server's Amazon EC2 instances to meet the peak requirements.
- B. Use Amazon API Gateway and direct transactions to the AWS Lambda functions as the application layer.
Use Amazon Simple Queue Service (Amazon SQS) as the communication layer between application services. - C. Use Amazon Simple Queue Service (Amazon SQS) to handle the messaging between application servers running on Amazon EC2 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SQS queue length and scale up when communication failures are detected.
- D. Use Amazon Simple Notification Service (Amazon SNS) to handle the messaging between application servers running on Amazon EC2 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SNS queue length and scale up and down as required.
Answer: C
NEW QUESTION # 287
A solutions architect needs to design a highly available application consisting of web, application, and database tiers. HTTPS content delivery should be as close to the edge as possible, with the least delivery time.
Which solution meets these requirements and is MOST secure?
- A. Configure a public Application Load Balancer (ALB) with multiple redundant Amazon EC2 instances in private subnets. Configure Amazon CloudFront to deliver HTTPS content using the public ALB as the origin.
- B. Configure a public Application Load Balancer (ALB) with multiple redundant Amazon EC2 instances in public subnets. Configure Amazon CloudFront to deliver HTTPS content using the public ALB as the origin.
- C. Configure a public Application Load Balancer with multiple redundant Amazon EC2 instances in public subnets. Configure Amazon CloudFront to deliver HTTPS content using the EC2 instances as the origin.
- D. Configure a public Application Load Balancer with multiple redundant Amazon EC2 instances in private subnets. Configure Amazon CloudFront to deliver HTTPS content using the EC2 instances as the origin.
Answer: A
Explanation:
This solution meets the requirements for a highly available application with web, application, and database tiers, as well as providing edge-based content delivery. Additionally, it maximizes security by having the ALB in a private subnet, which limits direct access to the web servers, while still being able to serve traffic over the Internet via the public ALB. This will ensure that the web servers are not exposed to the public Internet, which reduces the attack surface and provides a secure way to access the application.
NEW QUESTION # 288
A web application is hosted in a dedicated VPC that is connected to a company's on-premises data center over a Site-to-Site VPN connection. The application is accessible from the company network only. This is a temporary non-production application that is used during business hours. The workload is generally low with occasional surges.
The application has an Amazon Aurora MySQL provisioned database cluster on the backend. The VPC has an internet gateway and a NAT gateways attached. The web servers are in private subnets in an Auto Scaling group behind an Elastic Load Balancer. The web servers also upload data to an Amazon S3 bucket through the internet.
A solutions architect needs to reduce operational costs and simplify the architecture.
Which strategy should the solutions architect use?
- A. Review the Auto Scaling group settings and ensure the scheduled actions are specified to operate the Amazon EC2 instances during business hours only. Detach the internet gateway from the VPC, and use an Aurora Serverless database. Set up a VPC endpoint for the S3 bucket, then update the network routing and security rules and policies related to the changes.
- B. Use 3-year scheduled Reserved Instances for the web server Amazon EC2 instances. Remove the NAT gateways from the VPC, and set up a VPC endpoint for the S3 bucket. Use Amazon CloudWatch and AWS Lambda to stop and start the Aurora DB cluster so it operates during business hours only.
Update the network routing and security rules and policies related to the changes. - C. Review the Auto Scaling group settings and ensure the scheduled actions are specified to operate the Amazon EC2 instances during business hours only. Use 3-year scheduled Reserved Instances for the web server EC2 instances. Detach the internet gateway and remove the NAT gateways from the VPC.
Use an Aurora Serverless database and set up a VPC endpoint for the S3 bucket. - D. Review the Auto Scaling group settings and ensure the scheduled actions are specified to operate the Amazon EC2 instances during business hours only. Detach the internet gateway and remove the NAT gateways from the VPC. Use an Aurora Serverless database and set up a VPC endpoint for the S3 bucket, then update the network routing and security rules and policies related to the changes.
Answer: A
NEW QUESTION # 289
A law firm needs to share information with the public. The information includes hundreds of files that must be publicly readable. Modifications or deletions of the files by anyone before a designated future date are prohibited.
Which solution will meet these requirements in the MOST secure way?
- A. Upload all tiles to an Amazon S3 bucket that is configured for static website hosting. Grant read-only IAM permissions to any AWS principals that access the S3 bucket until the designated date.
- B. Upload all files to an Amazon S3 bucket that is configured for static website hosing. Select the folder that contains the files. Use S3 Object Lock with a retention period m accordance with the designated date Grant read-only IAM permissions to any AWS principals that access the S3 bucket
- C. Create a new Amazon S3 bucket with S3 Versioning enabled. Use S3 Object Lock with a retention period in accordance with the designated dale. Configure the S3 bucket for static website hosting Set an S3 bucket policy to allow read-only access to the objects.
- D. Create a new Amazon S3 bucket with S3 Versioning enabled Configure an event trigger to run an AWS Lambda function in case of object modification or deletion Configure the Lambda function to replace the objects with the original versions from a private S3 bucket
Answer: C
NEW QUESTION # 290
A company has a web application with sporadic usage patterns There is heavy usage at the beginning of each month moderate usage at the start of each week and unpredictable usage during the week The application consists of a web server and a MySQL database server running inside the data center The company would like to move the application to the AWS Cloud and needs to select a cost-effective database platform that will not require database modifications Which solution will meet these requirements?
- A. Amazon RDS for MySQL
- B. Amazon DynamoDB
- C. MySQL-compatible Amazon Aurora Serverless
- D. MySQL deployed on Amazon EC2 in an Auto Scaling group
Answer: C
Explanation:
Explanation
Amazon RDS for MySQL is a fully-managed relational database service that makes it easy to set up, operate, and scale MySQL deployments in the cloud. Amazon Aurora Serverless is an on-demand, auto-scaling configuration for Amazon Aurora (MySQL-compatible edition), where the database will automatically start up, shut down, and scale capacity up or down based on your application's needs. It is a simple, cost-effective option for infrequent, intermittent, or unpredictable workloads.
NEW QUESTION # 291
In regard to DynamoDB, for which one of the following parameters does Amazon not charge you?
- A. Cost per provisioned write units
- B. Cost per provisioned read units
- C. I/O usage within the same Region
- D. Storage cost
Answer: C
Explanation:
Explanation/Reference:
Explanation:
In DynamoDB, you will be charged for the storage and the throughput you use rather than for the I/O which has been used.
http://aws.amazon.com/dynamodb/pricing/
NEW QUESTION # 292
What does Amazon RDS stand for?
- A. Relational Database Service.
- B. Regional Database Service.
- C. Nothing.
- D. Regional Data Server.
Answer: A
NEW QUESTION # 293
You have an EC2 Security Group with several running EC2 instances. You change the Security Group rules to allow inbound traffic on a new port and protocol, and launch several new instances in the same Security Group. The new rules apply:
- A. Immediately to the new instances, but old instances must be stopped and restarted before the new rules apply.
- B. To all instances, but it may take several minutes for old instances to see the changes.
- C. Immediately to the new instances only.
- D. Immediately to all instances in the security group.
Answer: D
NEW QUESTION # 294
A client application requires operating system privileges on a relational database server.
What is an appropriate configuration for highly available database architecture?
- A. Amazon RDS in a multi-AZ configuration
- B. Amzon EC2 instances in a replication configuration utilizing a single Availability Zone
- C. Amazon EC2 instances in a replication configuration utilizing two different Availability Zones
- D. A standalone Amazon EC2 instance
Answer: C
NEW QUESTION # 295
A gaming company has multiple Amazon EC2 instances in a single Availability Zone for its multiplayer game that communicates with users on Layer 4 The chief technology officer (CTO) wants to make the architecture highly available and cost-effective.
What should a solutions architect do to meet these requirements? (Select TWO.)
- A. Configure an Application Load Balancer in front of the EC2 instances
- B. Decrease the number of EC2 instances
- C. Increase the number of EC2 instances.
- D. Configure an Auto Scaling group to add or remove instances in multiple Availability Zones automatically.
- E. Configure a Network Load Balancer in front of the EC2 instances.
Answer: D,E
NEW QUESTION # 296
A solutions architect Is designing a new API using Amazon API Gateway that will receive requests from users. The volume of requests is highly variable: several hours can pass without receiving a single request. The data processing will take place asynchronously, but should be completed within a few seconds after a request la made.
Which compute service should the solutions architect have the API invoke to deliver the requirements at the lowest cost?
- A. An AWS Glue job
- B. An AWS Lambda function
- C. A containerized service hosted in Amazon Elastic Kubemetes Service {Amazon EKS)
- D. A containerized service hosted in Amazon ECS with Amazon EC2
Answer: C
NEW QUESTION # 297
What is the durability of S3 RRS?
- A. 99.99%
- B. 99.95%
- C. 99.995%
- D. 99.999999999%
Answer: A
NEW QUESTION # 298
A company wants to restrict access to the content of one of its man web applications and to protect the content by using authorization techniques available on AWS. The company wants to implement a serverless architecture end an authentication solution for fewer tian 100 users. The solution needs to integrate with the main web application and serve web content globally. The solution must also scale as to company's user base grows while providing lowest login latency possible.
- A. Use AWS Directory Service for Microsoft Active Directory tor authentication Use AWS Lambda for authorization Use an Application Load Balancer to serve the web application globally
- B. Use AWS Directory Service for Microsoft Active Directory for authentication Use Lambda@Edge for authorization Use AWS Elastic Beanstalk to serve the web application.
- C. Use Amazon Cognito tor authentication. Use Lambda#Edge tor authorization Use Amazon CloudFront
10 serve the web application globally - D. Usa Amazon Cognito for authentication Use AWS Lambda tor authorization Use Amazon S3 Transfer Acceleration 10 serve the web application globally.
Answer: C
Explanation:
https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge Amazon CloudFront is a global content delivery network (CDN) service that can securely deliver web content, videos, and APIs at scale. It integrates with Cognito for authentication and with Lambda@Edge for authorization, making it an ideal choice for serving web content globally. Lambda@Edge is a service that lets you run AWS Lambda functions globally closer to users, providing lower latency and faster response times. It can also handle authorization logic at the edge to secure content in CloudFront. For this scenario, Lambda@Edge can provide authorization for the web application while leveraging the low-latency benefit of running at the edge.
NEW QUESTION # 299
A solutions architect is designing the architecture of a new application being deployed to the AWS Cloud The application will run on Amazon EC2 On-Demand Instances and will automatically scale across multiple Availability Zones The EC2 instances will scale up and down frequently throughout the day An Application Load Balancer (ALB) will handle the load distribution The architecture needs to support distributed session data management The company is willing to make changes to code if needed.
What should the solutions architect do to ensure that the architecture supports distributed session data management?
- A. Use session affinity (sticky sessions) of the ALB to manage session data.
- B. Use Session Manager from AWS Systems Manager to manage the session
- C. Use Amazon ElastiCache to manage and store session data
- D. Use the GetSessionToken API operation in AWS Security Token Service (AWS STS) to manage the session
Answer: C
NEW QUESTION # 300
Fill in the blanks: Resources that are created in AWS are identified by a unique identifier called an
- A. Amazon Resource Namespace
- B. Amazon Resource Number
- C. Amazon Resource Name
- D. Amazon Resource Nametag
Answer: C
NEW QUESTION # 301
Your application currently stores data on an unencrypted EBS volume. A new security policy mandates that all data must be encrypted at rest. How can you encrypt the data?
- A. Create a snapshot of the volume. Create a new, encrypted volume from the snapshot. Replace the volume.
- B. Modify the EBS settings to encrypt the volume. You do need to detach the volume or stop the instance.
- C. Create a snapshot of the volume. Make an encrypted copy of the snapshot. Create a new volume from the new snapshot. Replace the volume.
- D. Stop the instance. Detach the volume. Modify the EBS settings to encrypt the volume. Reattach the volume. Start the instance.
Answer: B
NEW QUESTION # 302
In the Amazon RDS which uses the SQL Server engine, what is the maximum size for a Microsoft SQL Server DB Instance with SQL Server Express edition?
- A. 2 TB per DB
- B. 10 GB per DB
- C. 100 GB per DB
- D. 1TB per DB
Answer: B
NEW QUESTION # 303
Your application provides data transmission services. Files containing data to be transformed are first uploaded to Amazon S3 and then transformed by a fleet of sport EC2 instances. Files submitted by your premium customers must be transformed with the highest Priority. How should you implement such a system?
- A. Use a single SQS queue. Each message contains the priority contains the priority level.
Transformation instances poll high=priority messages first - B. Use a DynamoDB table with an attribute defining the priority level. Transformation instances will scan the table for tasks, sorting results by priority level
- C. Use two SQS queues. One for high priority messages, the other for default priority.
Transformation instances first poll the high priority queue, if there is no message; they poll the default priority queue. - D. Use Route latency based-routing to send high priority tasks to the closet transformation instances.
Answer: C
NEW QUESTION # 304
A company's application is increasingly popular and experiencing latency because of high volume reads on the database server.
The service has the following properties:
A highly available REST API hosted in one region using Application Load Balancer (ALB) with auto
scaling.
A MySQL database hosted on an Amazon EC2 instance in a single Availability Zone.
The company wants to reduce latency, increase in-region database read performance, and have multi- region disaster recovery capabilities that can perform a live recovery automatically without any data or performance loss (HA/DR).
Which deployment strategy will meet these requirements?
- A. Use Amazon ElastiCache for Redis Multi-AZ with an automatic failover to cache the database read queries. Use AWS OpsWorks to deploy the API layer, cache layer, and existing database layer in two regions. Use Amazon Route 53 health checks on the ALB to trigger a DNS failover to the standby region if the health checks in the primary region fail. Back up the MySQL database frequently, and in the event of a failure in an active region, copy the backup to the standby region and restore the standby database.
- B. Use Amazon ElastiCache for Redis Multi-AZ with an automatic failover to cache the database read queries. Use AWS OpsWorks to deploy the API layer, cache layer, and existing database layer in two regions. In the event of failure, use Amazon Route 53 health checks on the database to trigger a DNS failover to the standby region if the health checks in the primary region fail. Back up the MySQL database frequently, and in the event of a failure in an active region, copy the backup to the standby region and restore the standby database.
- C. Use AWS CloudFormation StackSets to deploy the API layer in two regions. Migrate the database to an Amazon Aurora with MySQL database cluster with multiple read replicas in one region and a read replica in a different region than the source database cluster. Use Amazon Route 53 health checks to trigger a DNS failover to the standby region if the health checks to the primary load balancer fail. In the event of Route 53 failover, promote the cross-region database replica to be the master and build out new read replicas in the standby region.
- D. Use AWS CloudFormation StackSets to deploy the API layer in two regions. Add the database to an Auto Scaling group. Add a read replica to the database in the second region. Use Amazon Route 53 health checks in the primary region fail. Promote the cross-region database replica to be the master and build out new read replicas in the standby region.
Answer: C
NEW QUESTION # 305
A company has a serverless website with millions of objects in an Amazon S3 bucket. The company uses the S3 bucket as the origin for an Amazon CloudFront distribution. The company did not set encryption on the S3 bucket before the objects were loaded. A solutions architect needs to enable encryption for all existing objects and for all objects that are added to the S3 bucket in the future.
Which solution will meet these requirements with the LEAST amount of effort?
- A. Create a new S3 bucket. Turn on the default encryption settings for the new S3 bucket. Download all existing objects to temporary local storage. Upload the objects to the new S3 bucket.
- B. Navigate to Amazon S3 in the AWS Management Console. Browse the S3 bucket's objects. Sort by the encryption field. Select each unencrypted object. Use the Modify button to apply default encryption settings to every unencrypted object in the S3 bucket.
- C. Turn on the default encryption settings for the S3 bucket. Use the S3 Inventory feature to create a .csv file that lists the unencrypted objects. Run an S3 Batch Operations job that uses the copy command to encrypt those objects.
- D. Create a new encryption key by using AWS Key Management Service (AWS KMS). Change the settings on the S3 bucket to use server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Turn on versioning for the S3 bucket.
Answer: C
Explanation:
https://spin.atomicobject.com/2020/09/15/aws-s3-encrypt-existing-objects/
NEW QUESTION # 306
......
Online Questions - Valid Practice AWS-Solutions-Architect-Associate Exam Dumps Test Questions: https://www.practicetorrent.com/AWS-Solutions-Architect-Associate-practice-exam-torrent.html
100% Real AWS-Solutions-Architect-Associate dumps - Brilliant AWS-Solutions-Architect-Associate Exam Questions PDF: https://drive.google.com/open?id=143_1r7hf51tyifxVVVFJNmC98MNDPvdO